fix(release): support optional PAT for release-please PR creation (#24)

* fix(release): support optional PAT for release-please PR creation

Root cause of all-repo Release Please failures: the default GITHUB_TOKEN
cannot create pull requests when a repository's Settings > Actions >
General > Workflow permissions > "Allow GitHub Actions to create and
approve pull requests" toggle is disabled. release-please-action fails
atomically with:

  ##[error]release-please failed: GitHub Actions is not permitted to
  create or approve pull requests.

Because this happens inside the single manifest run, the already-merged
release commit's tag/GitHub Release is never created either — hence
'gh release list' returning empty even after 'chore(main): release
1.0.0' PRs were merged. The repeated 'commit could not be parsed'
messages for merge-commit and free-text subjects are pre-existing,
non-fatal release-please warnings (excluded from the changelog by
design) — not the cause of failure.

Confirmed via API on autogen, .github, and cas-platform:
  can_approve_pull_request_reviews: false

This adds an optional 'release-please-token' secret input to the
reusable workflow, passed through to the action as 'token:', falling
back to github.token when unset. This lets callers opt into a scoped
PAT / GitHub App installation token (which is not subject to the
Actions PR-creation restriction) without requiring the broader,
org-wide 'Allow Actions to create/approve PRs' setting to be enabled.

Backward compatible: no behavior change for existing pinned callers
until they (a) repin to a commit that includes this fix and (b) pass
a token via 'secrets: release-please-token' or 'secrets: inherit'.

* fix(release): pass PAT to release-please self-caller

---------

Co-authored-by: Kim Harjamäki <kim.harjamaki@prosimo.fi>

Author: OgeonX-Ai

.github/workflows/release-please-reusable.yml

@@ -1,6 +1,21 @@
 name: Release Please (reusable)
 on:
   workflow_call:
+    secrets:
+      release-please-token:
+        description: >
+          Optional PAT / GitHub App installation token used to create the
+          release-please pull request and GitHub Release. Required when the
+          calling repository has "Allow GitHub Actions to create and approve
+          pull requests" disabled (Settings > Actions > General > Workflow
+          permissions) — the default GITHUB_TOKEN cannot open pull requests
+          in that case and release-please-action fails with:
+            "GitHub Actions is not permitted to create or approve pull
+            requests."
+          Falls back to the default GITHUB_TOKEN when unset, preserving
+          existing behavior for repos that already allow Actions to create
+          PRs.
+        required: false
 jobs:
   release-please:
     runs-on: ubuntu-latest
@@ -12,5 +27,6 @@ jobs:
     steps:
       - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
+          token: ${{ secrets.release-please-token || github.token }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json

.github/workflows/release-please.yml

@@ -10,3 +10,5 @@ jobs:
       pull-requests: write
       issues: write
     uses: ./.github/workflows/release-please-reusable.yml
+    secrets:
+      release-please-token: ${{ secrets.RELEASE_PLEASE_TOKEN }}